0

I just installed Drupal 8.3.7 via composer and am trying to get user logins to work against our LDAP server. I added and enabled the following modules:

Drupal LDAP modules

We are using ldaps on port 636 rather than START-TLS on port 389 so I configured the LDAP settings as follows:

[SERVER section]
  Name: <whatever>
  Machine-readable name: ldap (not the hostname of our LDAP Server)
  LDAP Server Type: Default LDAP
  Server address: ldaps://<ip address of ldap server>
  Server port: 636

[BINDING section]
  Binding method for searches:L Service Account Bind: Use credentials in the Service Account field below to bind to LDAP
  DN for non-anonymous search: <dn for ldap auth user>
  Password for non-anonymous search: <password for ldap auth user>

[USERS section]
  <base dn for users>
  AuthName attribute: cn

When I try to test this config, I enter my cn in the "Testing Drupal Username" field and then click the Test button. I receive the following errors:

  Failed to bind with service account. LDAP error: Can't contact LDAP server (-1)
  Failed to find test user <my cn> by searching on cn = <my cn>.'

I can perform an ldapsearch using the auth ldap bind DN ok on the Drupal server. I enabled logging but the messages sent to /var/log/localmessages are not useful. I just see things like:

  ldap_search() function error. LDAP Error: Can't contact LDAP server (-1), ldap_search() parameters:
  LDAP search error: Can't contact LDAP server (-1). Context is base DN: <base dn> | filter: (cn=<my cn>)| attributes: []

Anyone have any ideas? I looked at the tcpcdump output comparing ldapsearch and the Drupal LDAP test and I don't see any TLS handshakes in the Drupal test case so I'm not convinced I have the ldaps part of the configuration working correctly.

  • I wrote a PHP script to try and emulate the Drupal LDAP behavior and the PHP script seems to work. No idea why the auth bind isn't working. – Albert Chin Sep 7 '17 at 16:28
0

Found the problem. I had a temporary cert in /tmp and specified in /etc/openldap/ldap.conf but systemd starts httpd with a private /tmp so the cert was not being found.

  • Is this the working solution? If so, you can mark your own answer as the accepted answer. This will help any other folks that happen to stumble upon the same problem. – chharvey Jul 12 '18 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.